The Permanent Siege — A Live Investigation Series

Letter F: The Defense Manual

How We Caught the Proxy Factory and How You Can Too

🛡️ The Defense Manual

Five letters documented what the proxy factory is, who operates it, and who enables it. This letter documents how we caught it — the exact stack, the exact pipeline, the exact configuration. Every component is open-source or commodity hardware. Total cloud cost: $0.

This is not a theoretical guide. This is the live configuration that produced 186,923 documented proxy verification events, identified 4 named persons, linked 3 shell companies to a sanctioned infrastructure ecosystem, and generated five published forensic dossiers in 94 days.

Cloud Cost

Days Running

186K

Events Captured

7,994

Unique IPs Profiled

Database Tables

779

Firewall Rules Active

I. The Architecture

The defense stack has six layers, each producing intelligence that feeds the next:

Layer 1: Honeypot — Cowrie SSH (Port 22, Forwarded via NAT)

Cowrie is an SSH/Telnet honeypot that records every login attempt, every command executed, every file downloaded, and every SOCKS5 tunnel attempt. It produces JSON log lines at /var/log/cowrie/cowrie.json with fields for IP, timestamp, session ID, username, password, HASSH fingerprint, SSH client version, destination host/port (for tunnel requests), and command data.

Layer 2: Firewall — MikroTik RouterOS

A MikroTik router at the network edge performs NAT port forwarding (SSH port → Cowrie) and enforces CrowdSec blacklists via address lists. Critical: Rule #1 deliberately exempts the honeypot from CrowdSec blocking — attackers must reach the honeypot to generate intelligence. The firewall blocks CrowdSec-listed IPs from all other services (43 forward rules, 779 address list entries).

Layer 3: Threat Intelligence — CrowdSec Community

CrowdSec's community threat intelligence feeds real-time IP reputation data. Locally, custom scenarios detect SSH brute-force patterns and retroactively ban confirmed attackers with 365-day decisions. CrowdSec maintains a global consensus network — when our honeypot identifies an attacker, that intelligence feeds back to protect other CrowdSec users worldwide.

Layer 4: Enrichment Pipeline — PostgreSQL + Python Workers

A Kubernetes-deployed enrichment pipeline (pentesting-v2-honeypot) ingests Cowrie JSON logs and enriches every IP with data from 8+ sources: Shodan (ports, services, vulnerabilities), AbuseIPDB (reputation), GreyNoise (classification), DShield (attack reports), RDAP (registration), Spamhaus (blocklists), and passive DNS. Results are stored in a 63-table PostgreSQL database with entity linking, campaign detection, and actor clustering.

Layer 5: OSINT Library — Elasticsearch (136K Documents)

A 136,617-document Elasticsearch index containing MITRE ATT&CK, Abuse.ch ThreatFox IOCs, Spamhaus ASN DROP data, cybersecurity research papers, WikiLeaks archives, court filings, and threat intelligence reports. 7.6 million semantic search chunks enable cross-referencing any honeypot finding against the entire OSINT corpus. When we find an IP hosting LummaC2, we can instantly verify it against Abuse.ch IOCs in our own library.

Layer 6: Analysis & Publication — MCP Tools + Dossier Pipeline

A Model Context Protocol (MCP) server exposes 299 tools for automated investigation: IP dossier generation, entity graph traversal, STIX/MISP sharing format export, defense correlation (CrowdSec + MikroTik + honeypot), and the dossier publication pipeline that produces the articles you're reading. Everything from raw honeypot log to published forensic article can be automated.

II. The Pipeline in Action

Here's exactly what happens when an attacker connects:

Connection arrives — Attacker SSHs to our public IP on port 22. MikroTik NAT forwards to Cowrie (Rule #22: 118,108 packets forwarded). CrowdSec Rule #1 exempts this traffic from blocking.

Cowrie records everything — Login credentials, SSH client version, HASSH fingerprint, key exchange algorithms. If the attacker opens a SOCKS5 tunnel, Cowrie records the destination host and port.

JSON log is ingested — The honeypot-v2 pipeline picks up the JSON line and begins enrichment within seconds.

IP is enriched from 8+ sources — Shodan scan (ports, services), AbuseIPDB lookup, GreyNoise classification, RDAP registration data, Spamhaus blocklist check, DShield attack history, passive DNS resolution.

Entity links are computed — The pipeline finds other IPs sharing the same HASSH, same RDAP organization, same credentials, same SSH keys, same BGP upstream. These links become edges in the entity graph (110,134 total links across 7,994 IPs).

Campaigns are detected — HASSH-based campaign clustering groups IPs by client fingerprint. The Trident campaign (hassh-a7a87fbe) has 4 IPs and 3,289 attempts. The w1n campaign (hassh-57e4cc8e) has 3 IPs and 3,200 attempts. 57 total campaigns detected.

Actor clusters form — IPs are grouped into 14 operator clusters based on shared signals (HASSH, credentials, timing, infrastructure). Cluster membership enables cross-investigation.

CrowdSec decision — If the IP matches a brute-force scenario, a 365-day ban decision is created. This ban propagates to MikroTik address lists, protecting all other services — but NOT the honeypot.

Telegram alert — High-threat events trigger Telegram notifications for real-time awareness.

Dossier investigation — Evidence, actors, findings, and connections are saved to a structured dossier database. The investigation can be exported as STIX 2.1 bundles, MISP events, or human-readable forensic articles.

III. Critical Design Decisions

The Honeypot Exemption (Most Important Rule)

# MikroTik Firewall Rule #1 — CRITICAL
/ip firewall filter add chain=forward action=accept \
    dst-address=192.0.2.10 protocol=tcp \
    comment="Honeypot: accept ALL to Cowrie (bypass CrowdSec fwd drop)" \
    place-before=*CrowdSec*

This rule must come before the CrowdSec blacklist drop rule. Without it, CrowdSec would block known attackers from reaching the honeypot, which defeats the purpose. The honeypot must accept ALL traffic to generate intelligence. The CrowdSec drop rules protect everything ELSE on the network.

HASSH as Primary Fingerprint

HASSH (SSH client key exchange algorithm fingerprint) is the single most valuable identifier in the entire pipeline. Even when attackers rotate SSH client version strings (w1n uses 37 different versions), rotate credentials, and rotate source IPs — the HASSH fingerprint remains constant because it reflects the underlying SSH library, not the spoofable version string.

HASSH	Campaign	IPs	Attempts	Success Rate
a7a87fbe86774c2e	Trident (PL + OMEGATECH)	4	3,289	100%
57e4cc8ee36c3d78	w1n (proxy verification)	3	3,200	100%
03a80b21...	Largest brute-force	1,313	44,341	Variable

PostgreSQL over SQLite

The pipeline initially used SQLite (/home/lsn/cowrie/honeypot.db), which was adequate for basic logging. It was replaced with PostgreSQL in May 2026 when entity linking, campaign detection, and actor clustering required JOIN-heavy analytical queries across 100K+ rows. PostgreSQL's 63-table schema includes tables SQLite never had: entity_links (110K rows), actor_clusters, campaigns, active_scan_results, and deep enrichment tables.

IV. Hardware

Component	Specification	Role
Server	Dell Precision Tower 7910 — Xeon E5-2699 v4, 88 threads, 503 GiB RAM	Runs K3S cluster (51 namespaces, 115+ pods)
GPU	NVIDIA RTX 4060 Ti	Local LLM inference (Ollama, 47 models)
Router	MikroTik RouterOS	NAT, firewall, CrowdSec integration
NAS	Synology	NFS storage for persistent volumes

Total cloud cost: $0. The entire stack — honeypot, enrichment pipeline, OSINT library, defense tools, and publication system — runs on one refurbished enterprise workstation in a 44m² apartment in Iași, Romania. The electricity bill is the only recurring cost.

V. What You Need to Replicate This

You don't need a 88-thread server. Here's the minimum:

A honeypot — Cowrie is free, runs on any Linux box, and produces JSON logs. Deploy it behind a NAT rule that forwards port 22 from your public IP.
CrowdSec — Free, open-source, community-powered. Install on the same box as the honeypot or on your router. Create a firewall rule that exempts the honeypot from CrowdSec drops.
A database — PostgreSQL is ideal. Even SQLite works for small deployments. Store every credential, every HASSH, every session.
Enrichment — Free APIs: AbuseIPDB (1,000 lookups/day free), Shodan (100 lookups/month free), GreyNoise Community (limited free). RDAP is unlimited and free.
Entity linking — Group IPs by shared HASSH, shared credentials, shared RDAP organization. This is the step that turns individual events into campaigns.

That's it. Five components. The attackers will come to you. They always do — because they're scanning the entire internet. The question is whether you're watching when they arrive.

"We spent $0 on cloud infrastructure. We spent $0 on commercial threat intelligence feeds. We spent $0 on enterprise security tools. A refurbished workstation, open-source software, and the willingness to look. That's what it costs to document a transnational criminal proxy factory, trace it to sanctioned infrastructure, and name the operators. The tools are free. The infrastructure is free. The only investment is attention."

TI-2026-038F · The Permanent Siege · Letter F
Published by LSN Threat Intelligence · June 22, 2026
Sources: Live defense stack configuration, Cowrie, CrowdSec, MikroTik, PostgreSQL threat_intel, Elasticsearch OSINT, MCP server
Cross-referenced: 038A-E (entire Permanent Siege series)